Live › vulnerability › CVE-2026-111841
Go to dashboardFunnelKit Automations (wp-marketing-automations), a WordPress marketing plugin, has a cross-site request forgery flaw in versions through 3.8.5.2. A logged-in administrator who visits a malicious page could be tricked into making unwanted changes on the site.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 09:29 UTC. All times on this page are UTC.
Sites running FunnelKit Automations at version 3.8.5.2 or earlier are affected. The risk depends on logged-in administrators or editors who can be lured to a malicious page while signed in. Sites without this plugin can skip it.
No product ranges from the sources yet.
wp plugin get wp-marketing-automations --field=version using WP-CLI.3.8.5.2; the fixed version is unknown from the sources.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Cross-Site Request Forgery (CSRF) vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Cross Site Request Forgery.This issue affects FunnelKit Automations: from n/a through 3.8.5.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-111841")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.